Spyware / Malware / Virus Removal

Possible infection with Fissa and searchqu

11 min read

Looking for the outcome? Ask AI

JUAN6661 Topic Starter

Post #1August 12, 2011, 10:23 AM UTC

Hi.

My PC goes very slowly, the start is endless. Into my Firefox I cannot change the homepage that always is searchqu.com.
Also I have tried to eliminate the program Fissa and it does not allow it to me.

Can someone help me?

Here is the OTL log file results.

OTL logfile created on: 12/08/2011 12:06:04 - Run 2
OTL by OldTimer - Version 3.2.26.1 Folder = D:\Documents and Settings\Juan Manuel\Escritorio
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000C0A | Country: España | Language: ESN | Date Format: dd/MM/yyyy

1023,11 Mb Total Physical Memory | 533,61 Mb Available Physical Memory | 52,16% Memory free
3,90 Gb Paging File | 3,52 Gb Available in Paging File | 90,18% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = D: | %SystemRoot% = D:\WINDOWS | %ProgramFiles% = D:\Archivos de programa
Drive C: | 152,66 Gb Total Space | 31,29 Gb Free Space | 20,50% Space Free | Partition Type: NTFS
Drive D: | 111,78 Gb Total Space | 13,45 Gb Free Space | 12,03% Space Free | Partition Type: NTFS

Computer Name: JUAN-MANUEL | User Name: Juan Manuel | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - D:\Documents and Settings\Juan Manuel\Escritorio\OTL.exe (OldTimer Tools)
PRC - D:\WINDOWS\system32\AEADISRV.EXE (Andrea Electronics Corporation)
PRC - D:\Archivos de programa\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)
PRC - D:\Archivos de programa\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - D:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
PRC - D:\Archivos de programa\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - D:\Archivos de programa\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - D:\Archivos de programa\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - D:\Archivos de programa\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
PRC - D:\Archivos de programa\Ono\Centro de Servicios\CSO.exe (Ono)
PRC - D:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - D:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - D:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
PRC - D:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - D:\Documents and Settings\Juan Manuel\Escritorio\OTL.exe (OldTimer Tools)
MOD - D:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (AEADIFilters) – D:\WINDOWS\system32\AEADISRV.EXE (Andrea Electronics Corporation)
SRV - (AntiVirSchedulerService) – D:\Archivos de programa\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (AntiVirService) – D:\Archivos de programa\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AxsNmSvc) – D:\Archivos de programa\ActiveXperts\Network Monitor\AxsNmSvc.exe ()
SRV - (Autodesk Licensing Service) – D:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe (Autodesk)
SRV - (PMBDeviceInfoProvider) – D:\Archivos de programa\Sony\PMB\PMBDeviceInfoProvider.exe (Sony Corporation)
SRV - (odserv) – D:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE12\ODSERV.EXE (Microsoft Corporation)
SRV - (ose) – D:\Archivos de programa\Archivos comunes\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (MDM) – D:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (LMouFlt2) – D:\WINDOWS\system32\drivers\LMouFlt2.Sys (Logitech, Inc.)
DRV - (LHidFlt2) – D:\WINDOWS\system32\drivers\LHidFlt2.Sys (Logitech, Inc.)
DRV - (RTLE8023xp) – D:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (MBAMSwissArmy) – D:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (avipbb) – D:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) – D:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssmdrv) – D:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) – D:\Archivos de programa\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (RTLVLAN) – D:\WINDOWS\system32\drivers\RTLVLAN.SYS (Realtek Semiconductor Corporation )
DRV - (RTLTEAMING) – D:\WINDOWS\system32\drivers\RTLTEAMING.SYS (Realtek Semiconductor Corporation)
DRV - (RtNdPt5x) – D:\WINDOWS\system32\drivers\RtNdPt5x.sys (Realtek Semiconductor Corporation )
DRV - (ati2mtag) – D:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (SenFiltService) – D:\WINDOWS\system32\drivers\senfilt.sys (Sensaura)
DRV - (PID_0928) Logitech QuickCam Express(PID_0928) – D:\WINDOWS\system32\drivers\LV561AV.SYS (Logitech Inc.)
DRV - (LVUSBSta) – D:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (Sentinel) – D:\WINDOWS\System32\Drivers\SENTINEL.SYS (Rainbow Technologies, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://es.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = es
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 68 28 49 68 4D 57 CC 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKCU\..\URLSearchHook: {0974848a-b5bc-49f2-9778-307742b4a55d} - D:\Archivos de programa\softonic.com4\prxtbsof2.dll (Conduit Ltd.)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Facemoods Search"
FF - prefs.js..browser.search.defaultthis.engineName: "Google Powered Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Facemoods Search"
FF - prefs.js..browser.startup.homepage: "http://www.google.es/"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {ba14329e-9550-4989-b3f2-9732e92d17cc}:2.7.2.0
FF - prefs.js..extensions.enabledItems: {7b13ec3e-999a-4b70-b9cb-2617b8323822}:2.7.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {0974848a-b5bc-49f2-9778-307742b4a55d}:[removed]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: [removed]:[removed]
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..keyword.URL: "chrome://browser-region/locale/region.properties"

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: D:\Archivos de programa\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: D:\Archivos de programa\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: D:\Archivos de programa\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: D:\Archivos de programa\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Archivos de programa\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: D:\Archivos de programa\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8117.0416: D:\Archivos de programa\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: D:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: D:\Archivos de programa\Ono\Centro de Servicios\nprpspa.dll (Radialpoint Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: D:\Archivos de programa\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: D:\Archivos de programa\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@veetle.com/vbp;version=0.9.17: D:\Archivos de programa\Veetle\VLCBroadcast\npvbp.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetleCorePlugin,version=0.9.18: D:\Archivos de programa\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\@veetle.com/veetlePlayerPlugin,version=0.9.18: D:\Archivos de programa\Veetle\Player\npvlc.dll (Veetle Inc)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Archivos de programa\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Components: D:\Archivos de programa\Mozilla Firefox\components [2011/07/28 01:05:55 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 5.0\extensions\\Plugins: D:\Archivos de programa\Mozilla Firefox\plugins [2011/07/28 01:05:55 | 000,000,000 | —D | M]

[2010/04/10 21:29:38 | 000,000,000 | —D | M] (No name found) – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Extensions
[2011/08/04 13:10:51 | 000,000,000 | —D | M] (No name found) – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\extensions
[2011/06/25 02:51:59 | 000,000,000 | —D | M] (softonic.com4 Community Toolbar) – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\extensions\{0974848a-b5bc-49f2-9778-307742b4a55d}
[2010/04/28 19:00:33 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/06/25 02:51:47 | 000,000,000 | —D | M] (Zynga Community Toolbar) – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\extensions\{7b13ec3e-999a-4b70-b9cb-2617b8323822}
[2011/06/25 02:51:36 | 000,000,000 | —D | M] (Vuze Remote Community Toolbar) – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
[2011/03/27 21:53:59 | 000,000,000 | —D | M] (Conduit Engine) – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\extensions\[removed]
[2010/12/29 14:42:13 | 000,001,747 | —- | M] () – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\searchplugins\ask.uk.xml
[2010/04/17 11:32:41 | 000,000,903 | —- | M] () – D:\Documents and Settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\searchplugins\conduit.xml
[2011/06/11 02:02:37 | 000,000,000 | —D | M] (No name found) – D:\Archivos de programa\Mozilla Firefox\extensions
[2010/05/01 15:44:51 | 000,000,000 | —D | M] (Java Console) – D:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/07/28 20:04:44 | 000,000,000 | —D | M] (Java Console) – D:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/14 20:54:55 | 000,000,000 | —D | M] (Java Console) – D:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2011/01/01 15:40:49 | 000,000,000 | —D | M] (Java Console) – D:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011/02/17 00:15:07 | 000,000,000 | —D | M] (Java Console) – D:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
[2011/06/11 02:02:37 | 000,000,000 | —D | M] (Java Console) – D:\Archivos de programa\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}
File not found (No name found) –
[2010/05/01 15:44:32 | 000,000,000 | —D | M] (Java Quick Starter) – D:\ARCHIVOS DE PROGRAMA\JAVA\JRE6\LIB\DEPLOY\JQS\FF
() (No name found) – D:\DOCUMENTS AND SETTINGS\JUAN MANUEL\DATOS DE PROGRAMA\MOZILLA\FIREFOX\PROFILES\EOZCXNSA.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI
() (No name found) – D:\DOCUMENTS AND SETTINGS\JUAN MANUEL\DATOS DE PROGRAMA\MOZILLA\FIREFOX\PROFILES\EOZCXNSA.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2011/06/25 02:50:05 | 000,142,296 | —- | M] (Mozilla Foundation) – D:\Archivos de programa\mozilla firefox\components\browsercomps.dll
[2011/05/04 04:52:23 | 000,476,904 | —- | M] (Sun Microsystems, Inc.) – D:\Archivos de programa\mozilla firefox\plugins\npdeployJava1.dll
[2009/08/03 15:07:42 | 000,373,104 | —- | M] (Microsoft Corporation) – D:\Archivos de programa\mozilla firefox\plugins\npOGAPlugin.dll
[2011/05/02 21:11:21 | 000,002,252 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\bing.xml
[2011/05/02 21:11:21 | 000,003,996 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\drae.xml
[2011/05/02 21:11:21 | 000,001,143 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\eBay-es.xml
[2010/07/28 15:15:32 | 000,002,036 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\fcmdSrchCcd2.xml
[2010/09/02 10:09:41 | 000,005,529 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\SearchquWebSearch.xml
[2011/05/02 21:11:21 | 000,001,178 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\wikipedia-es.xml
[2011/05/02 21:11:21 | 000,001,102 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\yahoo-es.xml

O1 HOSTS File: ([2010/01/28 21:03:30 | 000,000,906 | R— | M]) - D:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (softonic.com4 Toolbar) - {0974848a-b5bc-49f2-9778-307742b4a55d} - D:\Archivos de programa\softonic.com4\prxtbsof2.dll (Conduit Ltd.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Archivos de programa\Archivos comunes\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Archivos de programa\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {7FF99715-3016-4381-84CE-E4E4C9673020} - No CLSID value found.
O2 - BHO: (Windows Live Aplicación auxiliar de inicio de sesión) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - D:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Archivos de programa\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (softonic.com4 Toolbar) - {0974848a-b5bc-49f2-9778-307742b4a55d} - D:\Archivos de programa\softonic.com4\prxtbsof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Archivos de programa\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (softonic.com4 Toolbar) - {0974848A-B5BC-49F2-9778-307742B4A55D} - D:\Archivos de programa\softonic.com4\prxtbsof2.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - D:\Archivos de programa\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] D:\Archivos de programa\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [CSO.exe] D:\Archivos de programa\Ono\Centro de Servicios\CSO.exe (Ono)
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [Logitech Utility] D:\WINDOWS\Logi_MwX.Exe (Logitech Inc.)
O4 - HKLM..\Run: [LVCOMSX] D:\WINDOWS\system32\LVCOMSX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [PlusService] D:\Archivos de programa\Yuna Software\Messenger Plus!\PlusService.exe (Yuna Software)
O4 - HKLM..\Run: [SunJavaUpdateSched] D:\Archivos de programa\Archivos comunes\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] D:\Archivos de programa\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Google Sidewiki… - D:\Archivos de programa\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll (Google Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Archivos de programa\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab (Checkers Class)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} http://messenger.zone.msn.com/MessengerGam…1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - D:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - D:\Archivos de programa\Archivos comunes\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - D:\Archivos de programa\Archivos comunes\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - D:\Archivos de programa\Archivos comunes\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (d:\archiv~1\wi9130~1\datamngr\datamngr.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - D:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - D:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Mi página de inicio actual) - About:Home
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - D:\Archivos de programa\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011/08/12 04:52:11 | 000,000,000 | —D | M] - C:\AUTOBIOGRAFIA RAQUEL – [ NTFS ]
O32 - AutoRun File - [2010/01/22 07:57:46 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2006/11/19 05:29:30 | 000,001,705 | —- | M] () - C:\AUTORUN.APM – [ NTFS ]
O32 - AutoRun File - [2010/04/04 11:23:54 | 000,000,000 | RHSD | M] - C:\Autorun.inf – [ NTFS ]
O32 - AutoRun File - [2010/04/04 11:23:54 | 000,000,000 | RHSD | M] - D:\Autorun.inf – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/12 03:22:27 | 000,000,000 | RH-D | C] – D:\Documents and Settings\Juan Manuel\Recent
[2011/08/11 17:00:09 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Datos de programa\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2011/08/10 13:31:39 | 000,000,000 | —D | C] – D:\Archivos de programa\ESET
[2011/08/10 11:09:07 | 000,139,656 | —- | C] (Microsoft Corporation) – D:\WINDOWS\System32\dllcache\rdpwd.sys
[2011/08/10 11:08:04 | 000,010,496 | —- | C] (Microsoft Corporation) – D:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/08/07 19:29:02 | 000,579,584 | —- | C] (OldTimer Tools) – D:\Documents and Settings\Juan Manuel\Escritorio\OTL.exe
[2011/08/07 01:20:06 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Datos de programa\SonicFocus
[2011/08/07 01:19:19 | 000,364,544 | —- | C] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADIExt.dll
[2011/08/07 01:19:19 | 000,208,896 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXProc.dll
[2011/08/07 01:19:19 | 000,139,264 | —- | C] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADIAPO.dll
[2011/08/07 01:19:19 | 000,122,880 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXCPStr.dll
[2011/08/07 01:19:19 | 000,090,112 | —- | C] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADISRV.EXE
[2011/08/07 01:19:19 | 000,070,144 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXSAPO.dll
[2011/08/07 01:19:19 | 000,069,632 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXHAPO.dll
[2011/08/07 01:19:19 | 000,069,632 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXDAPO.dll
[2011/08/07 01:19:19 | 000,062,464 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXComm.dll
[2011/08/07 01:19:19 | 000,053,760 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXMAPO.dll
[2011/08/07 01:19:19 | 000,050,176 | —- | C] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADIAPR.dll
[2011/08/07 01:19:19 | 000,034,304 | —- | C] (Analog Devices, Inc.) – D:\WINDOWS\System32\SmaxCo.dll
[2011/08/07 01:19:18 | 000,156,672 | —- | C] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXCPBL.dll
[2011/08/05 01:42:48 | 000,000,000 | —D | C] – D:\Documents and Settings\Juan Manuel\Menú Inicio\Programas\Revo Uninstaller
[2011/08/05 01:05:44 | 001,915,904 | —- | C] (AVAST Software) – D:\Documents and Settings\Juan Manuel\Escritorio\aswMBR.exe
[2011/08/05 00:59:21 | 000,388,608 | —- | C] (Trend Micro Inc.) – D:\Documents and Settings\Juan Manuel\Escritorio\HiJackThis.exe
[2011/08/01 11:53:55 | 000,000,000 | —D | C] – D:\Archivos de programa\Yuna Software
[2011/07/28 21:00:27 | 000,073,576 | —- | C] (Logitech, Inc.) – D:\WINDOWS\System32\drivers\LMouFlt2.Sys
[2011/07/28 21:00:27 | 000,026,104 | —- | C] (Logitech, Inc.) – D:\WINDOWS\System32\drivers\LHidFlt2.Sys
[2011/07/28 21:00:27 | 000,019,968 | —- | C] (Logitech Inc.) – D:\WINDOWS\Logi_MwX.Exe
[2011/07/28 20:54:13 | 000,102,416 | —- | C] (Realtek Semiconductor Corporation) – D:\WINDOWS\System32\RTNUninst32.dll
[2011/07/28 20:42:14 | 000,005,632 | —- | C] (Microsoft Corporation) – D:\WINDOWS\System32\dllcache\intelide.sys
[2011/07/28 19:10:24 | 000,000,000 | —D | C] – D:\Documents and Settings\Juan Manuel\Configuración local\Datos de programa\PackageAware
[2011/07/28 19:04:39 | 000,000,000 | —D | C] – D:\Documents and Settings\Juan Manuel\Datos de programa\Download Manager
[2011/07/22 02:09:24 | 000,000,000 | —D | C] – D:\Documents and Settings\Juan Manuel\Mis documentos\PELICULAS
[21 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/12 12:12:00 | 000,000,500 | -H– | M] () – D:\WINDOWS\tasks\User_Feed_Synchronization-{6D52C113-A381-4B00-85B5-D0B76712D4B9}.job
[2011/08/12 12:08:00 | 000,000,492 | -H– | M] () – D:\WINDOWS\tasks\User_Feed_Synchronization-{29E7E046-7EB6-4AEE-B711-3706FCD5908F}.job
[2011/08/12 12:06:00 | 000,001,102 | —- | M] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/08/12 12:00:35 | 000,579,584 | —- | M] (OldTimer Tools) – D:\Documents and Settings\Juan Manuel\Escritorio\OTL.exe
[2011/08/12 04:57:58 | 000,109,056 | —- | M] () – D:\Documents and Settings\Juan Manuel\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/08/12 03:18:47 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – D:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/08/12 03:14:59 | 000,002,206 | —- | M] () – D:\WINDOWS\System32\wpa.dbl
[2011/08/12 03:14:44 | 000,001,098 | —- | M] () – D:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/08/12 03:14:43 | 000,000,282 | —- | M] () – D:\WINDOWS\tasks\SpeedUpMyPC.job
[2011/08/12 03:13:44 | 000,002,048 | –S- | M] () – D:\WINDOWS\bootstat.dat
[2011/08/10 11:57:41 | 000,522,798 | —- | M] () – D:\WINDOWS\System32\perfh00A.dat
[2011/08/10 11:57:41 | 000,435,818 | —- | M] () – D:\WINDOWS\System32\perfh009.dat
[2011/08/10 11:57:41 | 000,096,438 | —- | M] () – D:\WINDOWS\System32\perfc00A.dat
[2011/08/10 11:57:41 | 000,068,714 | —- | M] () – D:\WINDOWS\System32\perfc009.dat
[2011/08/10 04:10:34 | 000,001,876 | —- | M] () – D:\Documents and Settings\All Users\Escritorio\Google Chrome.lnk
[2011/08/08 12:30:00 | 000,000,298 | —- | M] () – D:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/08/07 01:19:19 | 000,364,544 | —- | M] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADIExt.dll
[2011/08/07 01:19:19 | 000,208,896 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXProc.dll
[2011/08/07 01:19:19 | 000,156,672 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXCPBL.dll
[2011/08/07 01:19:19 | 000,139,264 | —- | M] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADIAPO.dll
[2011/08/07 01:19:19 | 000,122,880 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXCPStr.dll
[2011/08/07 01:19:19 | 000,090,112 | —- | M] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADISRV.EXE
[2011/08/07 01:19:19 | 000,070,144 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXSAPO.dll
[2011/08/07 01:19:19 | 000,069,632 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXHAPO.dll
[2011/08/07 01:19:19 | 000,069,632 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXDAPO.dll
[2011/08/07 01:19:19 | 000,062,464 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXComm.dll
[2011/08/07 01:19:19 | 000,053,760 | —- | M] (Sonic Focus, Inc.) – D:\WINDOWS\System32\SFFXMAPO.dll
[2011/08/07 01:19:19 | 000,050,176 | —- | M] (Andrea Electronics Corporation) – D:\WINDOWS\System32\AEADIAPR.dll
[2011/08/07 01:19:19 | 000,034,304 | —- | M] (Analog Devices, Inc.) – D:\WINDOWS\System32\SmaxCo.dll
[2011/08/06 00:57:40 | 000,001,049 | —- | M] () – D:\Documents and Settings\Juan Manuel\Escritorio\Dropbox.lnk
[2011/08/05 01:42:49 | 000,000,966 | —- | M] () – D:\Documents and Settings\Juan Manuel\Escritorio\Revo Uninstaller.lnk
[2011/08/05 01:06:38 | 001,915,904 | —- | M] (AVAST Software) – D:\Documents and Settings\Juan Manuel\Escritorio\aswMBR.exe
[2011/08/05 00:59:22 | 000,388,608 | —- | M] (Trend Micro Inc.) – D:\Documents and Settings\Juan Manuel\Escritorio\HiJackThis.exe
[2011/08/05 00:56:28 | 000,625,664 | —- | M] () – D:\Documents and Settings\Juan Manuel\Escritorio\dds.scr
[2011/07/28 21:00:27 | 000,073,576 | —- | M] (Logitech, Inc.) – D:\WINDOWS\System32\drivers\LMouFlt2.Sys
[2011/07/28 21:00:27 | 000,026,104 | —- | M] (Logitech, Inc.) – D:\WINDOWS\System32\drivers\LHidFlt2.Sys
[2011/07/28 21:00:27 | 000,019,968 | —- | M] (Logitech Inc.) – D:\WINDOWS\Logi_MwX.Exe
[2011/07/28 20:54:13 | 000,277,352 | —- | M] (Realtek Semiconductor Corporation ) – D:\WINDOWS\System32\drivers\Rtenicxp.sys
[2011/07/28 20:54:13 | 000,102,416 | —- | M] (Realtek Semiconductor Corporation) – D:\WINDOWS\System32\RTNUninst32.dll
[2011/07/28 20:54:13 | 000,081,936 | —- | M] () – D:\WINDOWS\System32\RtNicProp32.dll
[2011/07/28 18:05:47 | 000,001,665 | —- | M] () – D:\Documents and Settings\Juan Manuel\Escritorio\Mozilla Firefox.lnk
[2011/07/28 01:08:25 | 000,000,833 | —- | M] () – D:\Documents and Settings\All Users\Escritorio\Malwarebytes' Anti-Malware.lnk
[2011/07/28 01:05:53 | 000,010,809 | —- | M] () – D:\WINDOWS\System32\QuickTime.qtp
[2011/07/26 21:03:28 | 000,000,731 | —- | M] () – D:\Documents and Settings\All Users\Escritorio\CCleaner.lnk
[2011/07/25 17:08:55 | 005,969,920 | —- | M] (Microsoft Corporation) – D:\WINDOWS\System32\dllcache\mshtml.dll
[2011/07/15 15:29:31 | 000,456,320 | —- | M] (Microsoft Corporation) – D:\WINDOWS\System32\dllcache\mrxsmb.sys
[21 D:\WINDOWS\System32\*.tmp files -> D:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/05 00:56:27 | 000,625,664 | —- | C] () – D:\Documents and Settings\Juan Manuel\Escritorio\dds.scr
[2011/08/01 17:15:06 | 000,000,282 | —- | C] () – D:\WINDOWS\tasks\SpeedUpMyPC.job
[2011/07/28 20:54:13 | 000,081,936 | —- | C] () – D:\WINDOWS\System32\RtNicProp32.dll
[2011/07/28 01:08:25 | 000,000,833 | —- | C] () – D:\Documents and Settings\All Users\Escritorio\Malwarebytes' Anti-Malware.lnk
[2011/06/10 22:57:19 | 001,110,093 | —- | C] () – D:\WINDOWS\System32\Vfw.dll
[2011/06/10 22:57:17 | 000,056,832 | —- | C] () – D:\WINDOWS\System32\Iyvu9_32.dll
[2011/06/10 22:57:13 | 000,151,056 | —- | C] () – D:\WINDOWS\System32\IR32.DLL
[2011/06/10 22:57:13 | 000,077,664 | —- | C] () – D:\WINDOWS\System32\IR21.DLL
[2011/06/10 22:57:12 | 004,767,232 | —- | C] () – D:\WINDOWS\System32\GFXLIB32.DLL
[2011/06/10 22:57:11 | 000,194,726 | —- | C] () – D:\WINDOWS\System32\Audio.dll
[2011/06/10 22:57:11 | 000,128,111 | —- | C] () – D:\WINDOWS\System32\Audio32.dll
[2011/05/22 13:00:41 | 000,063,488 | R— | C] () – D:\WINDOWS\xobglu16.dll
[2011/05/22 13:00:41 | 000,053,248 | —- | C] () – D:\WINDOWS\bspnet.dll
[2011/05/22 13:00:41 | 000,023,552 | R— | C] () – D:\WINDOWS\xobglu32.dll
[2011/03/26 16:17:57 | 000,008,273 | —- | C] () – D:\WINDOWS\wininit.ini
[2011/03/08 00:46:28 | 000,165,376 | —- | C] () – D:\WINDOWS\System32\unrar.dll
[2011/03/08 00:46:27 | 000,000,038 | —- | C] () – D:\WINDOWS\avisplitter.ini
[2011/03/08 00:46:22 | 000,810,496 | —- | C] () – D:\WINDOWS\System32\xvidcore.dll
[2011/03/08 00:46:22 | 000,183,808 | —- | C] () – D:\WINDOWS\System32\xvidvfw.dll
[2011/03/08 00:46:18 | 000,080,896 | —- | C] () – D:\WINDOWS\System32\ff_vfw.dll
[2011/02/08 01:53:22 | 000,000,286 | —- | C] () – D:\WINDOWS\reimage.ini
[2010/11/14 20:21:54 | 000,000,036 | —- | C] () – D:\Documents and Settings\Juan Manuel\Configuración local\Datos de programa\housecall.guid.cache
[2010/10/02 15:03:16 | 000,000,382 | —- | C] () – D:\WINDOWS\Disney.ini
[2010/06/03 00:21:28 | 000,484,352 | —- | C] () – D:\WINDOWS\System32\lame_enc.dll
[2010/04/24 18:51:54 | 000,003,654 | —- | C] () – D:\WINDOWS\System32\drivers\Sonyhcp.dll
[2010/04/10 21:29:24 | 000,000,000 | —- | C] () – D:\WINDOWS\nsreg.dat
[2010/02/22 21:04:55 | 000,053,248 | R— | C] () – D:\WINDOWS\System32\InstMed.exe
[2010/02/22 21:04:44 | 000,009,255 | —- | C] () – D:\WINDOWS\System32\lvcoinst.ini
[2010/02/22 21:03:53 | 000,000,272 | —- | C] () – D:\WINDOWS\_delis32.ini
[2010/02/07 12:33:00 | 000,520,192 | —- | C] () – D:\WINDOWS\System32\ati2sgag.exe
[2010/01/27 21:48:18 | 000,004,096 | —- | C] () – D:\WINDOWS\d3dx.dat
[2010/01/25 21:30:11 | 000,000,379 | —- | C] () – D:\WINDOWS\ODBC.INI
[2010/01/25 20:33:07 | 000,109,056 | —- | C] () – D:\Documents and Settings\Juan Manuel\Configuración local\Datos de programa\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/01/23 23:09:33 | 000,000,050 | —- | C] () – D:\WINDOWS\MegaManager.INI
[2010/01/23 16:50:35 | 000,001,324 | —- | C] () – D:\WINDOWS\System32\d3d9caps.dat
[2010/01/23 01:57:07 | 000,081,092 | -H– | C] () – D:\WINDOWS\System32\mlfcache.dat
[2010/01/22 17:38:27 | 000,000,000 | —- | C] () – D:\WINDOWS\ativpsrm.bin
[2010/01/22 17:35:15 | 000,887,724 | R— | C] () – D:\WINDOWS\System32\ativva6x.dat
[2010/01/22 17:35:14 | 003,107,788 | R— | C] () – D:\WINDOWS\System32\ativva5x.dat
[2010/01/22 17:35:14 | 000,142,347 | —- | C] () – D:\WINDOWS\System32\atiicdxx.dat
[2010/01/22 08:00:01 | 000,002,048 | –S- | C] () – D:\WINDOWS\bootstat.dat
[2010/01/22 07:54:36 | 000,021,900 | —- | C] () – D:\WINDOWS\System32\emptyregdb.dat
[2010/01/22 04:01:21 | 000,004,205 | —- | C] () – D:\WINDOWS\ODBCINST.INI
[2010/01/22 04:00:06 | 000,380,832 | —- | C] () – D:\WINDOWS\System32\FNTCACHE.DAT
[2009/08/03 16:07:42 | 000,403,816 | —- | C] () – D:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 16:07:42 | 000,230,768 | —- | C] () – D:\WINDOWS\System32\OGAEXEC.exe
[2008/05/26 23:23:18 | 000,016,892 | —- | C] () – D:\WINDOWS\System32\gthrctr.ini
[2008/05/26 23:23:16 | 000,023,640 | —- | C] () – D:\WINDOWS\System32\idxcntrs.ini
[2008/05/26 23:23:14 | 000,016,164 | —- | C] () – D:\WINDOWS\System32\gsrvctr.ini
[2008/05/26 22:59:42 | 000,018,904 | —- | C] () – D:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | —- | C] () – D:\WINDOWS\System32\structuredqueryschema.bin
[2006/12/17 04:30:22 | 003,107,788 | —- | C] () – D:\WINDOWS\System32\ativvaxx.dat
[2006/03/06 11:41:02 | 000,073,728 | —- | C] () – D:\WINDOWS\System32\AMV_DecDLL.dll
[2004/09/16 14:26:40 | 000,012,634 | —- | C] () – D:\WINDOWS\System32\drivers\ADFUUD.SYS
[2004/08/19 17:58:52 | 000,001,804 | —- | C] () – D:\WINDOWS\System32\dcache.bin
[2004/08/02 16:20:40 | 000,004,569 | —- | C] () – D:\WINDOWS\System32\secupd.dat
[2001/09/28 15:00:00 | 013,107,200 | —- | C] () – D:\WINDOWS\System32\oembios.bin
[2001/09/28 15:00:00 | 000,673,088 | —- | C] () – D:\WINDOWS\System32\mlang.dat
[2001/09/28 15:00:00 | 000,522,798 | —- | C] () – D:\WINDOWS\System32\perfh00A.dat
[2001/09/28 15:00:00 | 000,435,818 | —- | C] () – D:\WINDOWS\System32\perfh009.dat
[2001/09/28 15:00:00 | 000,317,534 | —- | C] () – D:\WINDOWS\System32\perfi00A.dat
[2001/09/28 15:00:00 | 000,272,128 | —- | C] () – D:\WINDOWS\System32\perfi009.dat
[2001/09/28 15:00:00 | 000,218,003 | —- | C] () – D:\WINDOWS\System32\dssec.dat
[2001/09/28 15:00:00 | 000,096,438 | —- | C] () – D:\WINDOWS\System32\perfc00A.dat
[2001/09/28 15:00:00 | 000,068,714 | —- | C] () – D:\WINDOWS\System32\perfc009.dat
[2001/09/28 15:00:00 | 000,046,258 | —- | C] () – D:\WINDOWS\System32\mib.bin
[2001/09/28 15:00:00 | 000,036,284 | —- | C] () – D:\WINDOWS\System32\perfd00A.dat
[2001/09/28 15:00:00 | 000,028,626 | —- | C] () – D:\WINDOWS\System32\perfd009.dat
[2001/09/28 15:00:00 | 000,004,463 | —- | C] () – D:\WINDOWS\System32\oembios.dat
[2001/09/28 15:00:00 | 000,000,741 | —- | C] () – D:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2010/02/27 12:21:26 | 000,000,000 | —D | M] – D:\Documents and Settings\All Users\Datos de programa\Autodesk
[2010/01/23 01:58:30 | 000,000,000 | —D | M] – D:\Documents and Settings\All Users\Datos de programa\Azureus
[2010/01/27 21:48:26 | 000,000,000 | —D | M] – D:\Documents and Settings\All Users\Datos de programa\BetyByte
[2011/06/09 21:53:26 | 000,000,000 | —D | M] – D:\Documents and Settings\All Users\Datos de programa\Messenger Plus!
[2010/01/31 23:46:49 | 000,000,000 | —D | M] – D:\Documents and Settings\All Users\Datos de programa\Ono
[2011/01/28 23:44:27 | 000,000,000 | —D | M] – D:\Documents and Settings\All Users\Datos de programa\TuneUp Software
[2011/01/28 23:39:55 | 000,000,000 | -HSD | M] – D:\Documents and Settings\All Users\Datos de programa\{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}
[2011/08/11 17:00:09 | 000,000,000 | —D | M] – D:\Documents and Settings\All Users\Datos de programa\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2010/02/02 00:46:04 | 000,000,000 | -HSD | M] – D:\Documents and Settings\All Users\Datos de programa\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
[2010/12/29 14:28:07 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\AnvSoft
[2010/02/27 12:21:26 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\Autodesk
[2011/08/01 20:29:48 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\Azureus
[2011/08/06 12:28:22 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\Dropbox
[2010/06/03 00:21:37 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\FreeAudioPack
[2011/05/15 18:24:09 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\FreshDiagnose
[2010/12/29 14:43:08 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\HamsterSoft
[2011/01/20 01:33:16 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\moovida-1
[2010/10/11 10:18:19 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\MSNInstaller
[2011/01/28 01:25:18 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\OfferBox
[2010/01/31 23:46:56 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\Ono
[2010/10/20 20:10:00 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\OpenOffice.org
[2011/08/12 02:56:26 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\PriceGong
[2011/04/20 11:54:30 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\searchquband
[2010/10/28 23:04:02 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\searchqutb
[2011/01/28 23:42:02 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\TuneUp Software
[2010/02/07 02:03:18 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\VSRevoGroup
[2010/01/29 22:38:29 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\Windows Desktop Search
[2010/01/29 22:38:30 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\Windows Search
[2011/08/12 03:14:43 | 000,000,282 | —- | M] () – D:\WINDOWS\Tasks\SpeedUpMyPC.job
[2011/08/12 12:08:00 | 000,000,492 | -H– | M] () – D:\WINDOWS\Tasks\User_Feed_Synchronization-{29E7E046-7EB6-4AEE-B711-3706FCD5908F}.job
[2011/08/12 12:12:00 | 000,000,500 | -H– | M] () – D:\WINDOWS\Tasks\User_Feed_Synchronization-{6D52C113-A381-4B00-85B5-D0B76712D4B9}.job

========== Purity Check ==========

< End of report >

CatByte

Post #2August 15, 2011, 5:29 PM UTC

Hi,

Please do the following:

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
[2010/09/02 10:09:41 | 000,005,529 | —- | M] () – D:\Archivos de programa\mozilla firefox\searchplugins\SearchquWebSearch.xml
O2 - BHO: (no name) - {7FF99715-3016-4381-84CE-E4E4C9673020} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
[2011/08/11 17:00:09 | 000,000,000 | —D | C] – D:\Documents and Settings\All Users\Datos de programa\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}
[2011/04/20 11:54:30 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\searchquband
[2010/10/28 23:04:02 | 000,000,000 | —D | M] – D:\Documents and Settings\Juan Manuel\Datos de programa\searchqutb

:Files
ipconfig /flushdns /c

:Commands
[resethosts]
[emptyflash]
[purity]
[emptytemp]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post the OTL log

NEXT

Download ComboFix from one of the following locations:
Link 1
Link 2

VERY IMPORTANT !!! Save ComboFix.exe to your Desktop

* IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

Double click on ComboFix.exe & follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

[external image: Posted Image]

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

JUAN6661

Post #3August 15, 2011, 11:28 PM UTC

Hi Catbyte.
Thank you for your help.

Before continuing I must inform you that, for motives of work, I will be absent of my house until Friday, the 19th.

Please do not close this topic if I do not answer you until this day. Thank you very much.

Here you have the results of for what you have asked me.

All processes killed
========== OTL ==========
D:\Archivos de programa\Mozilla Firefox\searchplugins\SearchquWebSearch.xml moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7FF99715-3016-4381-84CE-E4E4C9673020}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7FF99715-3016-4381-84CE-E4E4C9673020}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\!{2318C2B1-4965-11d4-9B18-009027A5CD4F} deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
D:\Documents and Settings\All Users\Datos de programa\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} folder moved successfully.
D:\Documents and Settings\All Users\Datos de programa\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42} folder moved successfully.
D:\Documents and Settings\Juan Manuel\Datos de programa\searchquband folder moved successfully.
D:\Documents and Settings\Juan Manuel\Datos de programa\searchqutb\widgets_cache folder moved successfully.
D:\Documents and Settings\Juan Manuel\Datos de programa\searchqutb\weather folder moved successfully.
D:\Documents and Settings\Juan Manuel\Datos de programa\searchqutb\games folder moved successfully.
D:\Documents and Settings\Juan Manuel\Datos de programa\searchqutb folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Configuración IP de Windows
Se vació con éxito la caché de resolución de DNS.
D:\Documents and Settings\Juan Manuel\Escritorio\cmd.bat deleted successfully.
D:\Documents and Settings\Juan Manuel\Escritorio\cmd.txt deleted successfully.
========== COMMANDS ==========
D:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: Administrador
->Flash cache emptied: 647 bytes

User: All Users

User: Ana

User: Ariadna
->Flash cache emptied: 1887 bytes

User: Default User

User: Juan Manuel
->Flash cache emptied: 3844 bytes

User: LocalService

User: NetworkService

User: Raquel

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: Administrador
->Temp folder emptied: 1878 bytes
->Temporary Internet Files folder emptied: 1713018 bytes
->FireFox cache emptied: 26040850 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Ana

User: Ariadna
->Temp folder emptied: 23469215 bytes
->Temporary Internet Files folder emptied: 14389975 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 56148986 bytes
->Google Chrome cache emptied: 167461420 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Juan Manuel
->Temp folder emptied: 49267933 bytes
->Temporary Internet Files folder emptied: 7643740 bytes
->Java cache emptied: 1526926 bytes
->FireFox cache emptied: 398413146 bytes
->Google Chrome cache emptied: 83006806 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 2401631 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 84962938 bytes

User: Raquel

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 18425152 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 98787 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 892,00 mb

OTL by OldTimer - Version 3.2.26.1 log created on 08162011_003341

Files\Folders moved on Reboot…

Registry entries deleted on Reboot…

ComboFix 11-08-15.08 - Juan Manuel 16/08/2011 1:00.1.2 - x86
Running from: d:\documents and settings\[removed]\Escritorio\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
d:\archivos de programa\OfferBox
d:\archivos de programa\OfferBox\[removed]\components\OfferBoxXpCom.dll
d:\documents and settings\Ariadna\Datos de programa\OfferBox
d:\documents and settings\Ariadna\Datos de programa\OfferBox\config.dat
d:\documents and settings\Ariadna\Datos de programa\OfferBox\config.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\1.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\a.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\b.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\c.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\d.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\e.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\f.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\g.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\h.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\i.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\J.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\k.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\l.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\m.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\mru.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\n.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\o.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\p.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\q.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\r.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\s.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\t.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\u.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\v.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\w.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\x.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\y.xml
d:\documents and settings\Ariadna\Datos de programa\PriceGong\Data\z.xml
d:\documents and settings\Ariadna\Datos de programa\searchqutb
d:\documents and settings\Ariadna\Datos de programa\searchqutb\dtx.ini
d:\documents and settings\Ariadna\Datos de programa\searchqutb\games\00d2dfc64c07a4f32824abac1d6f735b
d:\documents and settings\Ariadna\Datos de programa\searchqutb\games\3e4265e00cbc4a9cf22a105046a46d8a
d:\documents and settings\Ariadna\Datos de programa\searchqutb\games\44a5d79f5451d3036ba3986425e234c8
d:\documents and settings\Ariadna\Datos de programa\searchqutb\games\GameCategories.xml
d:\documents and settings\Ariadna\Datos de programa\searchqutb\games\GameTypes.xml
d:\documents and settings\Ariadna\Datos de programa\searchqutb\guid.dat
d:\documents and settings\Ariadna\Datos de programa\searchqutb\preferences.dat
d:\documents and settings\Ariadna\Datos de programa\searchqutb\stats.dat
d:\documents and settings\Ariadna\Datos de programa\searchqutb\uninstallIE.dat
d:\documents and settings\Ariadna\Datos de programa\searchqutb\weather\cf4c54374992f5aec7fe027c854f9cf1
d:\documents and settings\Ariadna\Datos de programa\searchqutb\weather\f923a5fa8343acfd431298b096fb473f
d:\documents and settings\Ariadna\Datos de programa\searchqutb\weather\forecasts_cache.xml
d:\documents and settings\Ariadna\Datos de programa\searchqutb\weather\observations_cache.xml
d:\documents and settings\Ariadna\Datos de programa\searchqutb\weatherbutton_prefs.xml
d:\documents and settings\Ariadna\Datos de programa\searchqutb\widgets_cache\84b70525cff6359fdeca553342c23e4c
d:\documents and settings\Ariadna\Datos de programa\searchqutb\widgets_cache\bf5b6317ae07da699882fc948f22eda4
d:\documents and settings\Ariadna\Datos de programa\searchqutb\widgets_cache\category_cache.xml
d:\documents and settings\Ariadna\Datos de programa\searchqutb\widgets_cache\widget_cache.xml
d:\documents and settings\Juan Manuel\Datos de programa\OfferBox
d:\documents and settings\Juan Manuel\Datos de programa\OfferBox\config.dat
d:\documents and settings\Juan Manuel\Datos de programa\OfferBox\config.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\1.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\a.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\b.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\c.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\d.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\e.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\f.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\g.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\h.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\i.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\J.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\k.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\l.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\m.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\mru.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\n.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\o.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\p.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\q.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\r.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\s.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\t.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\u.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\v.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\w.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\x.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\y.xml
d:\documents and settings\Juan Manuel\Datos de programa\PriceGong\Data\z.xml
.
.
((((((((((((((((((((((((( Files Created from 2011-07-15 to 2011-08-15 )))))))))))))))))))))))))))))))
.
.
2011-08-15 22:33 . 2011-08-15 22:33 ——– d—–w- D:\_OTL
2011-08-15 18:57 . 2011-08-15 18:57 ——– d—–w- d:\documents and settings\Juan Manuel\Datos de programa\TomTom
2011-08-15 18:57 . 2011-08-15 18:57 ——– d—–w- d:\documents and settings\Juan Manuel\Configuración local\Datos de programa\TomTom
2011-08-15 18:57 . 2011-08-15 18:57 ——– d—–w- d:\archivos de programa\TomTom International B.V
2011-08-15 18:56 . 2011-08-15 18:57 ——– d—–w- d:\archivos de programa\TomTom HOME 2
2011-08-14 13:26 . 2011-08-15 22:45 ——– d—–w- d:\documents and settings\Juan Manuel\Tracing
2011-08-10 11:31 . 2011-08-10 11:31 ——– d—–w- d:\archivos de programa\ESET
2011-08-10 09:09 . 2011-06-24 14:10 139656 -c—-w- d:\windows\system32\dllcache\rdpwd.sys
2011-08-10 09:08 . 2011-07-08 14:02 10496 -c—-w- d:\windows\system32\dllcache\ndistapi.sys
2011-08-06 23:20 . 2011-08-06 23:20 ——– d—–w- d:\documents and settings\All Users\Datos de programa\SonicFocus
2011-08-01 09:53 . 2011-08-01 09:53 ——– d—–w- d:\archivos de programa\Yuna Software
2011-07-28 19:00 . 2011-07-28 19:00 73576 —-a-w- d:\windows\system32\drivers\LMouFlt2.Sys
2011-07-28 19:00 . 2011-07-28 19:00 26104 —-a-w- d:\windows\system32\drivers\LHidFlt2.Sys
2011-07-28 19:00 . 2011-07-28 19:00 19968 —-a-w- d:\windows\Logi_MwX.Exe
2011-07-28 18:54 . 2011-07-28 18:54 81936 —-a-w- d:\windows\system32\RtNicProp32.dll
2011-07-28 18:54 . 2011-07-28 18:54 102416 —-a-w- d:\windows\system32\RTNUninst32.dll
2011-07-28 18:42 . 2008-04-14 00:54 5632 -c–a-w- d:\windows\system32\dllcache\intelide.sys
2011-07-28 18:42 . 2008-04-14 00:54 5632 —-a-w- d:\windows\system32\drivers\intelide.sys
2011-07-28 17:10 . 2011-07-28 17:10 ——– d—–w- d:\documents and settings\Juan Manuel\Configuración local\Datos de programa\PackageAware
2011-07-28 17:04 . 2011-07-28 17:04 ——– d—–w- d:\documents and settings\Juan Manuel\Datos de programa\Download Manager
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-08-12 01:18 . 2011-05-16 19:23 404640 —-a-w- d:\windows\system32\FlashPlayerCPLApp.cpl
2011-07-28 18:54 . 2010-01-22 17:21 277352 —-a-w- d:\windows\system32\drivers\Rtenicxp.sys
2011-07-15 13:29 . 2004-08-03 23:15 456320 —-a-w- d:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2001-09-28 13:00 10496 —-a-w- d:\windows\system32\drivers\ndistapi.sys
2011-07-06 17:52 . 2010-11-16 00:51 41272 —-a-w- d:\windows\system32\drivers\mbamswissarmy.sys
2011-07-06 17:52 . 2010-11-16 00:51 22712 —-a-w- d:\windows\system32\drivers\mbam.sys
2011-06-24 14:10 . 2010-01-22 05:53 139656 —-a-w- d:\windows\system32\drivers\rdpwd.sys
2011-06-23 18:30 . 2004-08-19 15:43 1469440 ——w- d:\windows\system32\inetcpl.cpl
2011-06-23 18:30 . 2004-08-19 15:42 916480 —-a-w- d:\windows\system32\wininet.dll
2011-06-23 18:30 . 2004-08-19 15:42 43520 —-a-w- d:\windows\system32\licmgr10.dll
2011-06-23 12:05 . 2004-08-19 15:23 385024 —-a-w- d:\windows\system32\html.iec
2011-06-20 17:44 . 2004-08-19 15:42 293888 —-a-w- d:\windows\system32\winsrv.dll
2011-06-06 11:35 . 2004-08-19 15:30 1859072 —-a-w- d:\windows\system32\win32k.sys
2011-06-25 00:50 . 2011-03-27 19:51 142296 —-a-w- d:\archivos de programa\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{0974848a-b5bc-49f2-9778-307742b4a55d}"= "d:\archivos de programa\softonic.com4\prxtbsof2.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{0974848a-b5bc-49f2-9778-307742b4a55d}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0974848a-b5bc-49f2-9778-307742b4a55d}]
2011-01-17 14:54 175912 —-a-w- d:\archivos de programa\softonic.com4\prxtbsof2.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 —-a-w- d:\archivos de programa\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{0974848a-b5bc-49f2-9778-307742b4a55d}"= "d:\archivos de programa\softonic.com4\prxtbsof2.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "d:\archivos de programa\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{0974848a-b5bc-49f2-9778-307742b4a55d}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{0974848A-B5BC-49F2-9778-307742B4A55D}"= "d:\archivos de programa\softonic.com4\prxtbsof2.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "d:\archivos de programa\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{0974848a-b5bc-49f2-9778-307742b4a55d}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\Juan Manuel\Datos de programa\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\Juan Manuel\Datos de programa\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\Juan Manuel\Datos de programa\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2011-02-18 05:12 94208 —-a-w- d:\documents and settings\Juan Manuel\Datos de programa\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="d:\archivos de programa\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"swg"="d:\archivos de programa\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2010-01-22 39408]
"msnmsgr"="d:\archivos de programa\Windows Live\Messenger\msnmsgr.exe" [2010-04-16 3872080]
"TomTomHOME.exe"="d:\archivos de programa\TomTom HOME 2\TomTomHOMERunner.exe" [2011-04-22 247728]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="d:\archivos de programa\Avira\AntiVir Desktop\avgnt.exe" [2010-08-17 281768]
"CSO.exe"="d:\archivos de programa\Ono\Centro de Servicios\CSO.exe" [2009-06-09 2303216]
"LVCOMSX"="d:\windows\system32\LVCOMSX.EXE" [2004-10-08 221184]
"SunJavaUpdateSched"="d:\archivos de programa\Archivos comunes\Java\Java Update\jusched.exe" [2011-04-08 254696]
"Logitech Utility"="Logi_MwX.Exe" [2011-07-28 19968]
"PlusService"="d:\archivos de programa\Yuna Software\Messenger Plus!\PlusService.exe" [2011-05-26 800768]
"SoundMAXPnP"="d:\archivos de programa\Analog Devices\Core\smax4pnp.exe" [2005-05-18 925696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="d:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
d:\documents and settings\Ariadna\Men£ Inicio\Programas\Inicio\
OpenOffice.org 3.2.lnk - d:\archivos de programa\OpenOffice.org 3\program\quickstart.exe [2010-5-20 1195008]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "d:\archivos de programa\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="d:\archivos de programa\Messenger\msmsgs.exe" /background
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="d:\archivos de programa\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Argente Utilities"=d:\archivos de programa\Argente Utilities\Argente Utilities.exe /Tray
"DivXUpdate"="d:\archivos de programa\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"GrooveMonitor"="d:\archivos de programa\Microsoft Office\Office12\GrooveMonitor.exe"
"PMBVolumeWatcher"=d:\archivos de programa\Sony\PMB\PMBVolumeWatcher.exe
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Archivos de programa\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"d:\\Archivos de programa\\Microsoft Office\\Office12\\GROOVE.EXE"=
"d:\\Archivos de programa\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"d:\\Archivos de programa\\Metin2_Spain\\metin2client.bin"=
"d:\\Archivos de programa\\Mozilla Firefox\\firefox.exe"=
"d:\\Archivos de programa\\Messenger\\msmsgs.exe"=
"d:\\Archivos de programa\\Metin2_Spain\\metin2.bin"=
"d:\\Archivos de programa\\Windows Live\\Messenger\\wlcsdk.exe"=
"d:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"d:\\Archivos de programa\\Windows Live\\Sync\\WindowsLiveSync.exe"=
"d:\\Archivos de programa\\Ares\\Ares.exe"=
"d:\\Archivos de programa\\Google\\Google Earth\\plugin\\geplugin.exe"=
"d:\\Archivos de programa\\Azureus\\Azureus.exe"=
"d:\\Archivos de programa\\Mozilla Firefox\\plugin-container.exe"=
.
R2 AntiVirSchedulerService;Avira AntiVir Programador;d:\archivos de programa\Avira\AntiVir Desktop\sched.exe [22/01/2010 19:25 136360]
R2 PMBDeviceInfoProvider;PMBDeviceInfoProvider;d:\archivos de programa\Sony\PMB\PMBDeviceInfoProvider.exe [24/10/2009 3:18 360224]
R2 RtNdPt5x;Realtek NDIS Protocol Driver;d:\windows\system32\drivers\RtNdPt5x.sys [23/02/2011 0:09 27424]
R2 TomTomHOMEService;TomTomHOMEService;d:\archivos de programa\TomTom HOME 2\TomTomHOMEService.exe [22/04/2011 14:21 92592]
S2 gupdate;Servicio Google Update (gupdate);d:\archivos de programa\Google\Update\GoogleUpdate.exe [29/01/2010 18:46 135664]
S3 gupdatem;Servicio de Google Update (gupdatem);d:\archivos de programa\Google\Update\GoogleUpdate.exe [29/01/2010 18:46 135664]
S3 MBAMSwissArmy;MBAMSwissArmy;d:\windows\system32\drivers\mbamswissarmy.sys [16/11/2010 2:51 41272]
S3 RTLTEAMING;Realtek Intermediate Driver for Ethernet Extended Features;d:\windows\system32\drivers\RTLTEAMING.SYS [23/02/2011 0:09 34208]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;d:\windows\system32\drivers\RTLVLAN.SYS [23/02/2011 0:09 22944]
.
Contents of the 'Scheduled Tasks' folder
.
2011-08-08 d:\windows\Tasks\AppleSoftwareUpdate.job
- d:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2008-07-30 10:34]
.
2011-08-15 d:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- d:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-01-29 16:46]
.
2011-08-15 d:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- d:\archivos de programa\Google\Update\GoogleUpdate.exe [2010-01-29 16:46]
.
2011-08-15 d:\windows\Tasks\User_Feed_Synchronization-{29E7E046-7EB6-4AEE-B711-3706FCD5908F}.job
- d:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
2011-08-15 d:\windows\Tasks\User_Feed_Synchronization-{6D52C113-A381-4B00-85B5-D0B76712D4B9}.job
- d:\windows\system32\msfeedssync.exe [2009-03-08 03:31]
.
.
——- Supplementary Scan ——-
.
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - d:\archiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: E&xportar a Microsoft Excel - d:\archiv~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Enlace de descarga usando Mega Manager…
IE: Google Sidewiki… - d:\archivos de programa\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_70C5B381380DB17F.dll/cmsidewiki.html
TCP: DhcpNameServer = [removed] [removed]
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - ProfilePath - d:\documents and settings\Juan Manuel\Datos de programa\Mozilla\Firefox\Profiles\eozcxnsa.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine - Facemoods Search
FF - prefs.js: browser.startup.homepage - hxxp://www.google.es/
FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-{09FF4DB8-7DE9-4D47-B7DB-915DB7D9A8CA} - d:\documents and settings\All Users\Datos de programa\{3C0AACBF-B491-4BE5-BAF9-AA46E0629E42}\standard_1.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-16 01:09
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(712)
d:\windows\system32\Ati2evxx.dll
.
Completion time: 2011-08-16 01:14:00
ComboFix-quarantined-files.txt 2011-08-15 23:13
.
Pre-Run: 14.158.102.528 bytes libres
Post-Run: 14.266.875.904 bytes libres
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 9AF2CA39B9C3DC12CBD6D4F88FD2041C

CatByte

Post #4August 15, 2011, 11:32 PM UTC

Hi

Please do the following:

Please open your MalwareBytes AntiMalware Program
Click the Update Tab and search for updates
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

JUAN6661

Post #5August 16, 2011, 8:09 AM UTC

Hi Here are the results. Eset results. D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126444.dll a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126446.exe a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126449.exe a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126458.dll a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126459.dll a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126460.dll a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126461.dll a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126465.dll Win32/Adware.Bandoo application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0126466.dll Win32/Adware.Bandoo application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0135068.dll probably a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0135091.dll probably a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145232.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145233.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145234.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145235.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145236.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145337.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145338.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145339.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145340.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145341.rbf Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145454.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145455.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145456.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145457.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145458.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145466.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145631.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145632.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145633.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145634.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145635.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0145643.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0146864.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0146865.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0146866.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0146867.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0146868.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP307\A0147047.dll probably a variant of Win32/Adware.Bandoo.AA application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152843.exe Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152844.exe Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152845.exe Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152846.exe Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152847.exe Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152848.exe Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152849.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152850.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152851.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152852.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152853.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152854.exe Win32/RegistryBooster application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152855.exe Win32/SpeedUpMyPC application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152856.exe Win32/Adware.Toolbar.Dealio application D:\System Volume Information\_restore{F206EF47-5539-480E-9A08-467CC931D90D}\RP313\A0152857.exe Win32/RegistryBooster application Mbam log: Malwarebytes' Anti-Malware 1.51.1.1800 www.malwarebytes.org Versión de la Base de Datos: 7475 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 16/08/2011 3:41:28 mbam-log-2011-08-16 (03-41-28).txt Tipos de Análisis: Análisis Rápido Objetos examinados: 228180 Tiempo transcurrido: 19 minuto(s), 33 segundo(s) Procesos en Memoria Infectados: 0 Módulos de Memoria Infectados: 0 Claves del Registro Infectadas: 0 Valores del Registro Infectados: 0 Elementos de Datos del Registro Infectados: 0 Carpetas Infectadas: 0 Archivos Infectados: 0 Procesos en Memoria Infectados: (No se han detectado elementos maliciosos) Módulos de Memoria Infectados: (No se han detectado elementos maliciosos) Claves del Registro Infectadas: (No se han detectado elementos maliciosos) Valores del Registro Infectados: (No se han detectado elementos maliciosos) Elementos de Datos del Registro Infectados: (No se han detectado elementos maliciosos) Carpetas Infectadas: (No se han detectado elementos maliciosos) Archivos Infectados: (No se han detectado elementos maliciosos)

CatByte

Post #6August 16, 2011, 10:43 PM UTC

Those detections are in old restore points which we will clean up when ComboFix is uninstalled, just some housekeeping to do now, please do the following:

Visit ADOBE and download the latest version of Acrobat Reader (version X)
Having the latest updates ensures there are no security vulnerabilities in your system.

NEXT

Follow these steps to uninstall Combofix

Make sure your security programs are totally disabled.
Click START then RUN
Now copy/paste Combofix /uninstall into the runbox and click OK. Note the space between the ..X and the /U, it needs to be there.

[external image: Posted Image]

NEXT

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If there are any logs/tools remaining on your desktop > right click and delete them.

NEXT

Below I have included a number of recommendations for how to protect your computer against malware infections.

It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them Then consider a password keeper, to keep all your passwords safe. KeePass is a small utility that allows you to manage all your passwords.
Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.
Make Internet Explorer more secure
- Click Start > Run
- Type Inetcpl.cpl & click OK
- Click on the Security tab
- Click Reset all zones to default level
- Make sure the Internet Zone is selected & Click Custom level
- In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
- Next Click OK, then Apply button and then OK to exit the Internet Properties page.
Download TFC to your desktop
- Close any open windows.
- Double click the TFC icon to run the program
- TFC will close all open programs itself in order to run,
- Click the Start button to begin the process.
- Allow TFC to run uninterrupted.
- The program should not take long to finish it's job
- Once its finished it should automatically reboot your machine,
- if it doesn't, manually reboot to ensure a complete clean
It's normal after running TFC cleaner that the PC will be slower to boot the first time.
WOT, Web of Trust, warns you about risky websites that try to scam visitors, deliver malware or send spam. Protect your computer against online threats by using WOT as your front-line layer of protection when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites:
- Green to go
- Yellow for caution
- Red to stop
WOT has an addon available for both Firefox and IE
Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.
ERUNT (Emergency Recovery Utility NT) allows you to keep a complete backup of your registry and restore it when needed. The standard registry backup options that come with Windows back up most of the registry but not all of it. ERUNT however creates a complete backup set, including the Security hive and user related sections. ERUNT is easy to use and since it creates a full backup, there are no options or choices other than to select the location of the backup files. The backup set includes a small executable that will launch the registry restore if needed.
In light of your recent issue, I'm sure you'd like to avoid any future infections. Please take a look at this well written article:
PC Safety and Security–What Do I Need?.

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Thank you for your patience, and performing all of the procedures requested.

Please respond one last time so we can consider the thread resolved and close it, thank-you.

JUAN6661

Post #7August 20, 2011, 5:13 PM UTC

Hi Thank you for your help. I understand that my PC already is disinfected. I have realized all the tasks that you had entrusted me in your last response. Only I still have a doubt. It continues being an impossible uninstall the program Fissa. Have you some solution for this? It is dangerous programmes this one? Thanks again.

CatByte

Post #8August 20, 2011, 7:05 PM UTC

There isn't any evidence of that program even existing on your computer, so let's have a look for the leftover traces of it.

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
*fissa*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Did you ever try removing it with Revo Uninstaller?

Try this

Download and install the Revo Uninstaller

Double click the new Revo Uninstaller icon on your desktop to start the program
Scroll through the listed programs and Right Click on the program you wish to uninstall (Fissa)
From the pop out menu choose Uninstall
Click Yes to the confirmation dialogue
In the next window select the Advanced mode
Click Next to start uninstalling the program
Answer Yes to confirm the uninstall
When the program has completed the four steps, click Next to allow the program to search for leftovers
Once complete, click Next, then Finish

JUAN6661

Post #9August 21, 2011, 11:57 AM UTC

Hi Here you have the results of System Look SystemLook 30.07.11 by jpshortstuff Log created at 13:55 on 21/08/2011 by Juan Manuel Administrator - Elevation successful ========== filefind ========== Searching for "*fissa*" D:\Documents and Settings\Ariadna\Datos de programa\Mozilla\Firefox\Profiles\zl7tanaz.default\searchplugins\fissa.xml –a—- 2559 bytes [19:26 27/01/2011] [19:26 27/01/2011] 3CF2709C84D6F38C06D0B034159E53D6 D:\RECYCLER\S-1-5-21-1004336348-1677128483-682003330-1003\Dd2\FissaSearch.ico –a—- 9158 bytes [15:50 30/09/2010] [15:50 30/09/2010] 2D87C1775C4465B2D0BB5DB5CE6E08BA -= EOF =-

CatByte

Post #10August 21, 2011, 12:34 PM UTC

Hi

Please do the following:

Go to Start->Run and type in notepad and hit OK.

Then copy and paste the content of the following codebox into Notepad:

@echo off 
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in ( 
"D:\Documents and Settings\Ariadna\Datos de programa\Mozilla\Firefox\Profiles\zl7tanaz.default\searchplugins\fissa.xml"
"D:\RECYCLER\S-1-5-21-1004336348-1677128483-682003330-1003\Dd2\FissaSearch.ico" 
) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%g>>"%temp%\log.txt"
)
if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!
pause
del %0

Save the file to your DESKTOP as "find.bat". Make sure to save it with the quotes.
Once saved, the icon to click should look like this on your desktop:

[external image: Posted Image]
Double click find.bat. to run it. A small black box should open and close - this is normal.
Let me know if it deletes successfully.

JUAN6661

Post #11August 21, 2011, 1:48 PM UTC

Hi Deleted Successfully I run Revo Uninstaller succesfully too. Have we ended?

CatByte

Post #12August 21, 2011, 1:55 PM UTC

Are you having any more issues with Fissa? If not, then you are good to go

JUAN6661

Post #13August 21, 2011, 3:06 PM UTC

Hi. Not, already I do not have any more problems. Million thanks for your good and rapid work.

CatByte

Post #14August 21, 2011, 3:06 PM UTC

good to hear you are welcome stay safe

~CB

CatByte

Post #15August 28, 2011, 4:28 PM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Possible infection with Fissa and searchqu

✨ Ask AI

Ask AI